-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hey all...
Been watching a rather strange scan of our Class C for the past week; I
don't know if I'd even call it a scan. Perhaps a misconfigured machine, or
something? Here's a log snippet:
Feb 29 07:12:25 firepower kernel: Packet log: private1 DENY eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00 I=15817 F=0x00B8 T=47
(#7)
Feb 29 07:14:25 firepower kernel: Packet log: private1 DENY eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00 I=16104 F=0x00B8 T=47
(#7)
Feb 29 07:16:25 firepower kernel: Packet log: private1 DENY eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00 I=16310 F=0x00B8 T=47
(#7)
Feb 29 07:18:25 firepower kernel: Packet log: private1 DENY eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00 I=16430 F=0x00B8 T=47
(#7)
Feb 29 07:20:25 firepower kernel: Packet log: private1 DENY eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00 I=16564 F=0x00B8 T=47
(#7)
Feb 29 07:22:25 firepower kernel: Packet log: private1 DENY eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00 I=16767 F=0x00B8 T=47
(#7)
Feb 29 07:24:25 firepower kernel: Packet log: private1 DENY eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00 I=17015 F=0x00B8 T=47
(#7)
Feb 29 07:26:25 firepower kernel: Packet log: private1 DENY eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00 I=17227 F=0x00B8 T=47
(#7)
I'm denying all of them at the firewall. I'm rather curious as to what
it is, though. The source is a machine in Israel, and, as of yesterday, the
scans were continuing on an intermittent basis. When it's happening, it sends
out a packet to our machine exactly every two minutes.
Anybody have any idea on this one?
Mike
- ----------------------------------
Message sent on 02-Mar-00 at 15:54:35
Mike Murray
Apt 1402
666 Spadina Ave
Toronto, ON
M5S 2H8
Phone: (416) 323-3160
I can't think of anything pithy to say at
all, today. So, I ramble.
- ----------------------------------
-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.2
iQA/AwUBOL7VD4DBZTHOsqLmEQJNJACfagI24fOLNIjiyH8sRQ9VhUdGqU0AoPwa
mTR4DMdfuEIC9q30UubUW6L6
=wG8B
-----END PGP SIGNATURE-----
Received on Mar 03 2000
Intro
